@event4u/agent-config 14.11.0 → 14.13.0

package/dist/agent-src/contexts/communication/rules-auto/token-efficiency-mechanics.md

@@ -115,3 +115,43 @@ the enumerated-set carve-out.
 - User explicitly asks for full output — show it.
 
 → Detailed patterns: `docs/guidelines/agent-infra/output-patterns.md`
+
+## Independent calls go in ONE block — the evidence
+
+```
+CALLS WITH NO DEPENDENCY BETWEEN THEM GO IN THE SAME BLOCK.
+A SECOND CALL THAT DOES NOT READ THE FIRST ONE'S RESULT IS NOT A SECOND TURN.
+BEFORE EMITTING A SINGLE CALL, ASK WHAT ELSE IS ALREADY KNOWN TO BE NEEDED.
+```
+
+The ceiling above forbids repetition; this forbids the opposite failure —
+splitting work that had no reason to be split. It is stated because it is
+**measured, not suspected**: over ten sessions of this package,
+`probe_turnaround` reports a mean tool-call batch size of **1.01**, with 27 of
+2,889 tool-using requests (0.93 %) carrying more than one call. At a 4.7 s
+median generation latency, a request that fans out to 42 calls spends about five
+minutes on serialization before a single tool runs.
+
+**Nothing in this package caused that, and nothing in it can fix it.** The cause
+was looked for and is recorded as absent
+(`agents/evidence/analysis/agent-turnaround-2026-08-30.md` § E2): no rule, skill
+or template forbids parallel calls, and parallel calls do occur — so 1.01 is a
+tendency, not a floor with a mechanism behind it.
+
+**The discriminator is the dependency, never the count.** Two greps over
+different files, a status and a log, three independent reads named before the
+first one runs — one block. A read whose path comes out of the previous result —
+two blocks, and batching them would be guessing.
+
+**Do not read this as "write shorter commands".** In the same corpus, 98.1 % of
+`Bash` calls are already compound or heredoc, and the 18 % that exceed 1,500
+characters carry 75 % of all command bytes — those are one-shot scripts that each
+replace three to six round-trips. Splitting them trades one expensive call for
+several cheap ones and makes the number worse while looking like a fix.
+
+**Honest enforcement — `instruction-only`.** No gate can observe a call that was
+not batched: a transcript records the calls that happened, never the block they
+could have shared. `probe_turnaround` reports the rate afterwards and refuses to
+gate on a store CI does not have. This paragraph is the whole mechanism, and the
+roadmap that added it pre-committed to recording a null if the rate does not
+move rather than repeating the reminder more loudly.

package/dist/agent-src/contexts/execution/auto-dispatch-classification.md

@@ -232,8 +232,11 @@ NEVER A SILENTLY DEGRADED ANSWER. NO LLM CLASSIFIER FALLBACK (CUT C3).
 **Why rg-first** (council 2026-07-28, 2 rounds): the pre-registered benchmark
 behind the `code-graph-retrieval-null` claim (`docs/CLAIMS.md`) measured
 native-graph recall 0.365 vs grep 0.797 on graph-shaped questions — an
-indexing gap that keeps `code_graph.enabled` false permanently. The accelerant
-clause in the table above is that bound's escape hatch and is inert today.
+indexing gap that keeps `code_graph.enabled` false BY DEFAULT — not
+permanently: the 2026-08-15 withdrawal retracted that, and the figures predate
+the 2026-08-22 extractor repair. The accelerant clause above is that bound's
+escape hatch; `classifyLookup` reads the flag, so turning it on is the whole
+change.
 
 **Escalation, not degradation:** a primitive that returns nothing (index miss,
 pattern too ambiguous, report script absent) — **or an unusable result**

package/dist/agent-src/contexts/execution/autonomy-mechanics.md

@@ -157,6 +157,27 @@ When validating a single target, run the **specific** check, not a meta-task tha
 
 Concrete tool mapping — verify with the narrowest tool that proves the target green: a single `curl` / Playwright spec / browser run for HTTP behavior, the project's test runner with a `--filter` for one test, a debugger / `xdebug` step-through for one frame. Never substitute a meta-pipeline for a tool that pinpoints the failure.
 
+### Progress-primary ordering — and why the cap stays
+
+Where the objective is **countable** — findings closed, tests passing,
+occurrences remaining — the primary stop signal is **no progress** or a **new
+minimum**, and the N=3 iteration cap is the **backstop**. A counter alone cannot
+tell three attempts that each closed a finding from three that changed nothing.
+
+**Do not remove the cap.** A no-progress signal is only as good as the metric
+behind it, and a metric that stops moving because the MEASUREMENT broke looks
+exactly like one that stops moving because the work is done. The cap bounds the
+damage when the primary signal is wrong.
+
+The two stops are different outcomes and are reported as different words: the cap
+firing is `exhausted`, a repeating failure signature with budget left is
+`stagnated` — see
+[`terminal-states`](terminal-states.md). Collapsing them invites the wrong
+remedy, because raising a budget helps the first and never the second.
+
+Where the objective is NOT countable, the cap is the only signal and the N=3
+budget above applies unchanged.
+
 ## Adaptive effort & stop (RDP)
 
 Scale effort to task difficulty, and stop when marginal evidence drops — coupled

package/dist/agent-src/contexts/execution/evidence-discipline.md

@@ -95,6 +95,32 @@ L0–L4 are human shorthand for how deep a discovery went; they are documentatio
 only. The **same** evidence rules apply at every tier — no enforced state
 machine, no per-tier evidence relaxation.
 
+## Re-orient when the tree contradicts what you last read
+
+External edits invalidate evidence. When the user mentions they changed something
+outside this session, or a read contradicts the last known state of a file, the
+prior observation is **stale, not wrong** — and acting on it overwrites work that
+is not yours.
+
+Five steps, in order:
+
+1. Treat every prior observation of the affected paths as invalidated.
+2. Re-read the state — `git status`, then the affected files themselves.
+3. Reconstruct the assumption that broke. A file did not vanish; it was renamed,
+   a block moved, a symbol was extracted. Find where it went before concluding
+   it is gone.
+4. Preserve the external work. Never restore from your own stale copy.
+5. Say what changed if the scope or the conclusion moved, rather than
+   continuing as though the earlier reading still held.
+
+The failure this prevents is narrower than "be careful": it is re-applying a
+diff computed against a tree that no longer exists, which looks like a clean
+apply and silently reverts somebody's edit.
+
+**No gate covers this.** It is a re-read the transcript cannot distinguish from
+a first read, so it is model-carried — the same honesty boundary § Honest
+enforcement reality states for the rest of this file.
+
 ## Honest enforcement reality
 
 ```

package/dist/agent-src/contexts/execution/orchestration-telemetry.md

@@ -39,6 +39,7 @@ v1 forward-compat rule on unknown fields).
 |---|---|---|
 | `task_size_estimate` | int | Pre-dispatch estimate of the task's size (the orchestrator's sizing heuristic). Counts only, no body. |
 | `spawn_count` | int | Number of subagents dispatched for this task. `0` → handled in-session. |
+| `empty_cycles` | int \| null | Trigger fires suppressed as duplicates since the last outcome record. Reported as its OWN quantity and never folded into a success rate's numerator or denominator: a duplicate is not an outcome, and it is also not nothing — a rising count is what an idle loop looks like from outside. `null` = not tracked by this producer, which is **not** the same as zero duplicates observed. Deduplication rule in `src/scripts/_lib/empty_cycles.ts`: same key AND inside the window, both conjuncts required. |
 | `tiers` | string[] | Model tiers dispatched to, one entry per spawn class (e.g. `["sonnet","opus"]`). Tier names only, no prompts. |
 | `token_delta` | int | Net token cost of the dispatch versus the in-session baseline. Positive = orchestration cost more; negative = saved tokens. Counts only. |
 | `token_delta_provenance` | enum | `"measured"` when sourced from host-reported `usage` metadata (preferred); `"estimated"` when self-estimated from response length (mark always when host usage is unavailable). |

package/dist/agent-src/contexts/execution/subagent-response-contract.md

@@ -47,6 +47,46 @@ Direction chosen: **narrow the contract to what the validator already accepts**,
 not widen the validator. Widening makes every future divergence legal by
 construction, which is how one contract came to have three states.
 
+## Why success is gated, and not accepted
+
+```
+AN UNVERIFIED SELF-REPORT IS INDISTINGUISHABLE FROM A RESULT.
+A RETURN THAT CLAIMS SUCCESS AND SHOWS NO CHANGE AGAINST ITS OWN DECLARED
+OUTPUT CONTRACT IS NOT EVIDENCE OF SUCCESS. IT IS EVIDENCE OF A CLAIM.
+```
+
+**The failure this prevents.** Every downstream aggregation reads the recorded
+outcome, not the return. `src/scripts/extract_audit_patterns.ts` mines repeated
+patterns from it, and the per-asset effectiveness report is built on the same
+stream. A forged `success` does not stay one line: it becomes signal, and the
+report then recommends keeping an asset that never worked and retiring one that
+did. Nothing downstream can detect it, because at that point the forgery is
+indistinguishable from the thing it imitates — which is the whole reason the
+check has to happen where the record is written rather than where it is read.
+
+**Why the gate reads the declared output contract and not the diff.** The
+obvious rule — claimed success plus an empty diff is never a success — is wrong
+here, and wrong in a way that is worse than doing nothing. Analysis, review and
+read-only research dispatches are a large share of this repository's subagent
+traffic, and every one of them legitimately produces no diff. The unconditional
+rule would mark them all as failures and poison the same aggregation in the
+opposite direction. **Zero diff may be valid, so "zero diff = failure" must not
+be global.** The gate therefore fires only where the dispatch itself declared
+that a code change was the expected output.
+
+**An unmeasured diff is not an empty diff.** Where the producer did not measure,
+the gate does not fire. Treating "not measured" as zero manufactures the same
+forgery with the opposite sign, and an aggregation cannot tell the two apart any
+better than it can tell a forged success from a real one.
+
+Implemented by `envelopeOutcome` in `src/scripts/_lib/orchestration_record.ts`,
+the tree's only cross-domain outcome mapping. Because it is the only one, the
+mapping is **versioned**: lines carry `outcome_semantics`, and an absent field
+means the pre-2026-08-30 unconditional semantics. `audit-log-v1` is append-only,
+so a labelling change cannot be rolled back the way a gate can — a reader
+aggregating across the cutover segments on that field rather than inferring from
+a date.
+
 ### Per-field divergence, one row per field
 
 | Field | spawn-contract (f) | `team_dispatch` model JSON (`:297`) | `subagent_response.ts` validator | `dispatch_r2_reviewer` |

package/dist/agent-src/contexts/execution/subagent-steering.md

@@ -104,11 +104,23 @@ doing its job; the orchestrator verifies (or revises) the parent first.
 ## Rollback guardrails — surfaced, not auto-disabled
 
 ```
-A CONFIG PACKAGE RUNS NO DAEMON. THERE IS NO AUTOMATIC COHORT-DISABLE.
+A RESIDENT PROCESS HERE IS GOVERNED, NEVER AUTOMATIC. NO COHORT-DISABLE.
 BREACHES ARE SURFACED FROM THE AUDIT LOG FOR THE MAINTAINER / USER TO ACT ON.
 THE ONLY AUTOMATIC STOP IS THE PER-TARGET N=3 BUDGET.
 ```
 
+> **Amended 2026-08-27 (ADR-249).** The first line used to read *"A CONFIG
+> PACKAGE RUNS NO DAEMON"*, and that premise no longer holds: a **supervised**
+> resident process is permitted in core under four governance conditions
+> (`docs/contracts/resident-process-governance.md`, class P1). The block's force
+> is unchanged, because the daemon clause was never what it governed — the rule
+> here is that a breach never stops a cohort by itself, and that is if anything
+> more load-bearing now than when nothing could be running. The replacement
+> states the adopted constraint rather than an absence, which is the wording rule
+> the same reversal imposes on every surface: name what the repository holds
+> itself to, never a state of the world.
+
+
 The guardrail thresholds (`breachedGuardrails()`), read off the
 [`orchestration-telemetry`](orchestration-telemetry.md) audit signals:
 

package/dist/agent-src/contexts/execution/terminal-states.md

@@ -0,0 +1,96 @@
+# Terminal states — what a run REPORTS when it stops
+
+> `road-to-skill-ecosystem-runtime-enforcement` Phase 4. Loaded on demand;
+> the obligation surface is [`verify-before-complete`](../../rules/verify-before-complete.md).
+
+A run has exactly one terminal state, and reporting the wrong one is not a
+wording problem. **An error or an exhausted budget is never reported as
+success.** The failure this vocabulary exists to stop is the one that reads
+identically to a win: a loop that hit its iteration cap, a gate that could not
+run, an approval that never came — each ending with a summary that says the work
+is done.
+
+## The six states
+
+| state | what it means | what it is NOT |
+|---|---|---|
+| `success` | The stated objective is met AND verified by a command run this turn. | Not "the edits landed". Landing is not verifying. |
+| `clean-no-op` | Nothing needed doing, and that was **established**, not assumed. | Not "I found nothing" from a scan that never ran. A dead scope is `blocked`. |
+| `blocked` | An external precondition is missing: a credential, a permission, a service, a decision only the user can make. | Not "hard". A blocker is a thing that is absent, not a thing that is difficult. |
+| `approval-required` | The work is ready and the next action crosses a gate the agent may not cross alone. | Not `blocked`: nothing is missing, and the run produced a deliverable. |
+| `exhausted` | A declared budget ran out — iterations, tokens, spend, wall-clock. | **Never** `success`, whatever partial progress exists. The cap firing IS the outcome. |
+| `stagnated` | The budget has not run out and progress has stopped: the same failure signature is repeating. | Not `exhausted`. Stagnation is detected by a NO-PROGRESS signal, not by a counter. |
+
+**Why `exhausted` and `stagnated` are separate**, when both stop a loop: they
+have different remedies and different next actions. `exhausted` says *the work
+may be fine and the budget was too small* — raising it is a legitimate response.
+`stagnated` says *more of the same will not help* — raising the budget is the
+wrong response, and a vocabulary that collapses them invites exactly that.
+
+## The mapping onto roadmap glyphs, and the three states glyphs cannot express
+
+Roadmap checkboxes carry four glyphs. They describe a **step's disposition**, not
+a **run's outcome**, and the gap is not an oversight — it is what makes a
+budget-exhausted stop indistinguishable from a completed one in a dashboard.
+
+| glyph | meaning | nearest terminal state |
+|---|---|---|
+| `[x]` | done | `success` — and only when a verify clause was met |
+| `[ ]` | open | *(no state — the step has not run)* |
+| `[~]` | deferred | `blocked` or `approval-required`, undistinguished |
+| `[-]` | cancelled | *(a decision, not a run outcome)* |
+
+**Three states have no glyph, and they are exactly the ones a validation budget
+and a hard-blocker class produce:**
+
+1. **`exhausted`** — the run stopped at its cap with the step still open. The
+   glyph stays `[ ]`, which is identical to *never attempted*. A reader cannot
+   tell three failed attempts from zero.
+2. **`stagnated`** — same `[ ]`, and the distinction that matters (retrying is
+   pointless) is invisible.
+3. **`approval-required`** — collapses into `[~]` alongside `blocked`, so a
+   roadmap cannot show that the work is FINISHED and waiting on a human, versus
+   not startable at all.
+
+**This is recorded rather than fixed.** Adding glyphs would change a format that
+`update_roadmap_progress`, `check_roadmap_trackable`, `lint_empty_roadmaps` and
+every archived roadmap already parse — a migration, not a step. What the
+vocabulary buys today is that a run's CLOSING REPORT can say the word the glyph
+cannot.
+
+## Progress-primary ordering
+
+When the objective is **countable** — findings closed, tests passing, occurrences
+remaining — the primary stop signal is **no progress** or a **new minimum**, and
+the iteration cap is the **backstop**.
+
+**Do not remove the cap.** A no-progress signal is only as good as the metric
+behind it, and a metric that stops moving because the measurement broke looks
+exactly like a metric that stops moving because the work is done. The cap is what
+bounds the damage when the primary signal is wrong.
+
+Where the objective is not countable, the cap is the only signal and the N=3
+validation budget in [`autonomous-execution`](../../rules/autonomous-execution.md)
+applies unchanged.
+
+## Reporting contract
+
+A closing report names the state **by one of the six words above**, and where the
+state is not `success` it names what would change it:
+
+- `exhausted` — the budget that ran out, its value, and what was achieved inside it.
+- `stagnated` — the repeating failure signature, and the attempts it survived.
+- `blocked` — the missing thing, by name.
+- `approval-required` — the exact action awaiting approval.
+- `clean-no-op` — what was scanned, so "nothing to do" is distinguishable from
+  "nothing was read".
+
+## See also
+
+- [`verify-before-complete`](../../rules/verify-before-complete.md) — no
+  completion claim without fresh evidence; this names what to claim when the
+  claim is not completion.
+- [`autonomous-execution`](../../rules/autonomous-execution.md) — the N=3
+  validation budget whose firing is `exhausted`.
+- [`autonomy-mechanics`](autonomy-mechanics.md) — the budget's mechanics and the
+  adaptive-effort ordering this page's progress-primary section states.

package/dist/agent-src/rules/artifact-drafting-protocol.md

@@ -44,7 +44,7 @@ Fires once per creation task, not once per edit.
 
 ## The three phases
 
-**A — Understand** (≤ 5 clarifying questions: problem, trigger surface, should-trigger examples, near-misses, artifact type) · **B — Research** (mandatory four-surface overlap scan; open + skim the 3 nearest matches; extend-vs-create decision) · **C — Draft** (2-3 description variants first, then the body; live size enforcement). Per-phase procedure + the roadmap batch-mode carve-out: the mechanics guideline below.
+**A — Understand** (≤ 5 clarifying questions: problem, trigger surface, should-trigger examples, near-misses, artifact type) · **B — Research** (mandatory four-surface overlap scan; open + skim the 3 nearest matches; extend-vs-create decision, written into the artifact as `composition_review:`) · **C — Draft** (2-3 description variants first, then the body; live size enforcement). Per-phase procedure + the roadmap batch-mode carve-out: the mechanics guideline below.
 
 ## Golden rules
 

package/dist/agent-src/rules/broken-access-control.md

@@ -25,6 +25,10 @@ collision_ok:
   "tenant": "cross-tenant isolation is this rule's core subject"
 # obligation: line 55
 obligation_frequency: "per-edit"
+evidence:
+  source_type: external-standard
+  verified_on: 2026-08-30
+  normative_level: recommended
 ---
 
 # Broken Access Control

package/dist/agent-src/rules/code-provenance.md

@@ -25,6 +25,10 @@ enforced_by:
   - "instruction-only: close-the-source-and-re-derive is a pre-write reasoning step only the model observes; CI checks the ledger, never the derivation"
 # obligation: line 40
 obligation_frequency: "per-edit"
+evidence:
+  source_type: external-research
+  verified_on: 2026-08-30
+  normative_level: informative
 ---
 
 # Code Provenance

package/dist/agent-src/rules/design-fidelity.md

@@ -98,7 +98,7 @@ MANDATE, NEVER A **PIXEL** MANDATE — WHATEVER `design.fidelity_mode` SAYS.
 REPRODUCING A WIREFRAME'S GREYS 1:1 HONOURS THE WRONG HALF OF THE ARTEFACT.
 ```
 
-`strict` means *do not redesign*; never *reproduce a wireframe's placeholder greys*, which
+`strict` means *do not redesign*; never *reproduce a wireframe's placeholder grays*, which
 are **non-decisions** ([`wireframe`](../skills/wireframe/SKILL.md) § Gotchas).
 **The discriminator reads the ARTEFACT, never the prose.** A finished comp whose prose
 mentions a wireframe it replaces routes **strictly** — a reference to a previous artefact,

package/dist/agent-src/rules/domain-safety-pii.md

@@ -44,6 +44,10 @@ workspaces: [agent-config-maintainer, construction, engineering, finance, founde
 packs: [meta]
 # obligation: line 52
 obligation_frequency: "per-task"
+evidence:
+  source_type: external-standard
+  verified_on: 2026-08-30
+  normative_level: mandatory
 ---
 
 # Domain Safety — PII Redaction

package/dist/agent-src/rules/domain-safety-retention.md

@@ -29,6 +29,10 @@ workspaces: [agent-config-maintainer, construction, engineering, finance, founde
 packs: [meta]
 # obligation: line 47
 obligation_frequency: "per-turn"
+evidence:
+  source_type: external-standard
+  verified_on: 2026-08-30
+  normative_level: mandatory
 ---
 
 # Domain Safety — Data Retention

package/dist/agent-src/rules/engineering-safety-floor.md

@@ -30,6 +30,8 @@ collision_ok:
   "migration": "a prod migration is a hard-floor evidence surface (rollback path, blast radius)"
 # obligation: line 49
 obligation_frequency: "per-commit"
+evidence:
+  source_type: own-analysis
 ---
 
 # Engineering Safety Floor

package/dist/agent-src/rules/external-code-graph-interop.md

@@ -24,13 +24,12 @@ obligation_frequency: "per-turn"
 # External Code-Graph Interop
 
 Some repos commit a pre-built code-intelligence index — a `graph.json`-shaped
-artifact or a SCIP index (`index.scip`, `*.scip`). When one exists, it already
-answers "who calls X", "where is Y used", "what does this import" far more
-precisely than a fresh `grep`. This suite is an **orchestrator first, owner
-where it wins** (ADR-124): query a consumer-shipped index when it is present
-and fresh; where none is shipped or ours is measurably better, the suite's own
-native code-graph engine (default-off, benchmark-gated) covers the gap. Either
-way — query first, grep as fallback, and name which source answered.
+artifact or a SCIP index (`index.scip`, `*.scip`). One that exists is already
+built and structured, so it is the cheap first question for "who calls X",
+"where is Y used", "what does this import". This suite is an **orchestrator
+first, owner where it wins** (ADR-124): query a consumer-shipped index when it
+is present and fresh; where none is shipped, the native engine (default-off,
+benchmark-gated) covers the gap.
 
 ## The rule
 
@@ -59,6 +58,11 @@ AND the repo contains a detectable index:
 3. **Fall back to `grep`/read** only for what the index does not cover, and say
    so ("the index has no entry for X, so I grepped").
 
+Query-first is an **ordering** heuristic, never a claim the index answers better:
+measured 2026-08-28, zero of four graph-shaped classes beat `grep`, so no class
+is graph-first. Routing changes; permission does not. Figures:
+[`code-intelligence`](../skills/code-intelligence/SKILL.md) § Measured.
+
 ## When NOT to fire
 
 - No such index in the repo — normal `grep`/read is the right first move.
@@ -67,11 +71,9 @@ AND the repo contains a detectable index:
 ## See also
 
 - [`code-intelligence`](../skills/code-intelligence/SKILL.md) — the executable
-  routing skill: `agent-config code-graph detect|query|affected|path` over the
-  native engine or a consumer-shipped index, grep as the stated fallback. On
-  hook-capable hosts the PreToolUse `code-graph` nudge surfaces this once per
-  session; on instruction-file hosts this rule is the surface. Which of the two
-  you are on is `agent-config hooks:status`, not a guess from the host name.
+  routing skill (`agent-config code-graph detect|query|affected|path`), the
+  measured per-class figures, and the hook-vs-instruction-file surface question
+  (`agent-config hooks:status`, never a guess from the host name).
 - [`discovery_graph`](../scripts/discovery_graph.ts) — this suite's OWN artefact
   relation-graph (`affected`/`explain`); the external code-graph is the
   *source-code* analogue this rule defers to for code questions.

package/dist/agent-src/rules/improve-before-implement.md

@@ -64,16 +64,14 @@ Trigger-set above activates this routing on demand, independent of the disciplin
 **Challenge to improve, never to refuse.**
 
 The agent is a thought partner, not a gatekeeper. After presenting concerns:
-- User picks an option → execute immediately
-- User says "just do it" → execute immediately
+- User picks an option, or says "just do it" → execute immediately
 - Never argue twice about the same point
 - Never block work — delay is only justified if it prevents a clear mistake
 
 ## Creating new agent artifacts
 
-When the request is to create or significantly rewrite a skill, rule, command,
-or guideline, the "fit the existing architecture" check is handled by
-[`artifact-drafting-protocol`](artifact-drafting-protocol.md)'s Phase B
-(Research). Follow that protocol instead of improvising a one-shot check — it
-scans `src/` for overlap and reports candidates to extend
-before creating a new file.
+When the request is to create or significantly rewrite a skill, rule, command, or
+guideline, the "fit the existing architecture" check is handled by
+[`artifact-drafting-protocol`](artifact-drafting-protocol.md)'s Phase B (Research).
+Follow that protocol instead of improvising a one-shot check — it scans `src/` for
+overlap and reports candidates to extend before creating a new file.

package/dist/agent-src/rules/laravel-routing.md

@@ -26,7 +26,7 @@ obligation_frequency: "none"
 
 # Laravel Routing
 
-**Iron Law.** Laravel-flavoured PHP (Eloquent, Artisan, FormRequest, jobs, events, policies) → load the `laravel` skill, not `symfony-workflow` and not `php-coder`.
+**Iron Law.** Laravel-flavoured PHP → `laravel`. Discriminator: entry point and router, not the dependency list — `illuminate/*` with no skeleton marker is the third verdict.
 
 Body migrated to `skill:laravel`. Disambiguates the laravel ↔ symfony-workflow cluster head per [`adr-architectural-consensus-mechanism`](../docs/contracts/adr-architectural-consensus-mechanism.md).
 Trigger-set above activates this routing on demand, independent of the discipline profile (ADR-110).

package/dist/agent-src/rules/lethal-trifecta-guard.md

@@ -22,6 +22,10 @@ collision_ok:
   "src/agent-src/commands/": "command authoring reviews the three trifecta legs"
 # obligation: line 60
 obligation_frequency: "per-edit"
+evidence:
+  source_type: external-standard
+  verified_on: 2026-08-30
+  normative_level: recommended
 ---
 
 # Lethal-Trifecta Guard

package/dist/agent-src/rules/secret-vcs-guard.md

@@ -29,6 +29,8 @@ collision_ok:
   "commit": "committing is the credential-leak moment this guard exists for"
 # obligation: line 43
 obligation_frequency: "per-edit"
+evidence:
+  source_type: own-analysis
 ---
 
 # Secret-in-VCS Guard

package/dist/agent-src/rules/security-sensitive-stop.md

@@ -28,6 +28,8 @@ collision_ok:
   "tenant": "tenancy is a threat-model-before-edit surface"
 # obligation: line 36
 obligation_frequency: "per-edit"
+evidence:
+  source_type: own-analysis
 ---
 
 # Security-Sensitive Stop Rule

package/dist/agent-src/rules/source-confidentiality.md

@@ -91,43 +91,21 @@ substitute for not writing the attribution in the first place.
 
 ## Why this rule is not path-scoped
 
-Under ADR-236 (`docs/decisions/ADR-236-one-artefact-one-layer.md`) this rule is
-delivered by the PROJECT layer only — it exists to maintain this package, so the
-global layer no longer carries an unscoped twin of it. A `paths:`-scoped rule is
-**not re-injected after `/compact`** (ADR-227:79-80), so scoping it would mean the
-obligation silently disappears mid-session with nothing left to reload it.
-
-It is therefore delivered unconditionally, and the path triggers were removed
-rather than worked around. **This section is the shared record for all four such
-rules** — `no-roadmap-references`, `rule-type-governance` and `skill-quality` carry
-the same change and no note of their own. Two reasons: four copies of the rationale
-cost more standing context than the decision they explain, and the other three are
-migrated POINTER stubs held at their pointer's size by
-`check_rule_stub_ceiling` — prose added there is prose in the wrong place by that
-gate's own contract, which is what caught the first attempt to duplicate it.
-
-AI council 2026-08-20, 2/2 convergent on this option over three alternatives, with
-two independent decisive arguments. First: the obligation governs an **authoring
-decision**, which happens before any file exists for a path trigger to match — so
-path-scoping fails at greenfield creation whether or not a compaction ever occurs.
-Second: the measured cost is small against what the partition returns. Keeping an
-unscoped global copy was rejected because it re-creates the duplication the
-partition exists to remove; splitting the four by "has a CI gate" was rejected by
-both seats as the wrong axis — a validator observes an outcome, it does not hold an
-obligation during the session, and `rule-type-governance` has no gate at all.
-
-**Cost, measured and corrected.** An earlier revision of this note claimed 1,754
-tokens (1.8 % of the partition's 96,584-token saving). That figure was a
-`chars / 4` proxy over the projected files and **understated the real cost by about
-half**: `check_rule_activation_census`, which counts with the exact BPE tokenizer,
-measures the unconditional corpus growing **108,130 → 111,642, i.e. +3,512 tokens
-(3.6 %)** — and that number includes this rationale, which is why it lives in one
-place instead of four. The verdict does not depend on the figure: one seat argued
-the token axis was the wrong one entirely, the other that cost is a legitimate axis
-which simply loses this particular comparison. Both readings survive 3.6 %.
+Delivered unconditionally by the PROJECT layer, with no `paths:` triggers: the
+obligation governs an **authoring decision** taken before any file exists for a
+path trigger to match, and a path-scoped rule is not re-injected after
+`/compact`, so scoping it would make the obligation vanish mid-session. The
+measurement, the AI-council record of 2026-08-20, the three rejected
+alternatives and the +3,512-token cost this shared note carries for four rules
+live in
+[`source-confidentiality-mechanics`](../docs/guidelines/agent-infra/source-confidentiality-mechanics.md)
+§ Why these four rules are unconditional — moved there 2026-08-29 because a
+rationale paid on every subagent spawn is the most expensive place to keep an
+argument nobody re-reads.
 
 ## See also
 
+- [`source-confidentiality-mechanics`](../docs/guidelines/agent-infra/source-confidentiality-mechanics.md) — the claim/residual honesty clause, the two-class split by path, and the gate's shape checks and tiering.
 - [`source-of-truth`](source-of-truth.md) — edit `src/`, never the projections.
 - [`augment-edit-discipline`](augment-edit-discipline.md) — portability + cross-ref sync.
 - `src/scripts/_lib/link_crypto.ts` — encrypted link storage.

package/dist/agent-src/rules/symfony-routing.md

@@ -22,7 +22,7 @@ obligation_frequency: "none"
 
 # Symfony Routing
 
-**Iron Law.** Symfony-flavoured PHP (DI container, bundles, Doctrine entities, Messenger, Security voters, console commands) → load the `symfony-workflow` skill, not `laravel` and not `php-coder`.
+**Iron Law.** Symfony-flavoured PHP → `symfony-workflow`. Discriminator: entry point and router, not the dependency list — `symfony/*` with no skeleton marker is the third verdict.
 
 Body migrated to `skill:symfony-workflow`. Disambiguates the laravel ↔ symfony-workflow cluster head per [`adr-architectural-consensus-mechanism`](../docs/contracts/adr-architectural-consensus-mechanism.md).
 Trigger-set above activates this routing on demand, independent of the discipline profile (ADR-110).

package/dist/agent-src/rules/token-efficiency.md

@@ -28,6 +28,20 @@ NEVER CALL THE SAME TOOL >2 TIMES IN A ROW WITH SIMILAR PARAMETERS.
 IF YOU CATCH YOURSELF REPEATING → STOP, RETHINK, ASK.
 ```
 
+## Independent calls go in ONE block
+
+```
+CALLS WITH NO DEPENDENCY BETWEEN THEM GO IN THE SAME BLOCK.
+A CALL THAT DOES NOT READ THE PREVIOUS RESULT IS NOT A SECOND TURN.
+```
+
+The ceiling above forbids repetition; this forbids splitting work that had no
+reason to be split — measured mean batch size **1.01**, i.e. fully serial. The
+discriminator is the dependency, never the count. NOT "write shorter commands":
+the long commands are already the batching. `instruction-only` — nothing can
+observe a call that was not batched. Evidence + the absent-cause finding:
+[`token-efficiency-mechanics`](../contexts/communication/rules-auto/token-efficiency-mechanics.md).
+
 ## Enumerated file sets are ONE operation, not N repetitions
 
 The same-tool ceiling counts *repetition without new information* — the loop where the agent re-runs a tool because it did not learn from the last result. Reading N **declared, enumerated** files is the opposite: each read returns different content and the set was known before the first call. Counting it as N repetitions puts this rule in direct conflict with [`downstream-changes`](downstream-changes.md) ("find **ALL** callers, tests, imports") and with [`source-discovery-gate`](source-discovery-gate.md), which cannot be satisfied in two calls.

package/dist/agent-src/rules/tool-safety.md

@@ -12,6 +12,10 @@ enforced_by:
   - "validator:src/scripts/lint_agent_security.ts"
 # obligation: line 19
 obligation_frequency: "per-edit"
+evidence:
+  source_type: external-standard
+  verified_on: 2026-08-30
+  normative_level: recommended
 ---
 
 # Tool Safety

package/dist/agent-src/rules/untrusted-input-defense.md

@@ -21,6 +21,10 @@ enforced_by:
   - "instruction-only: no deterministic gate inspects fetched content for injected instructions; injection_scan_hook is warn-only and default-OFF"
 # obligation: line 38
 obligation_frequency: "per-event"
+evidence:
+  source_type: external-standard
+  verified_on: 2026-08-30
+  normative_level: recommended
 ---
 
 <!-- security-lint: allow instruction-smuggling "defense rule: quotes role-takeover phrases (ignore previous instructions, you are now, <IMPORTANT>) to teach refusal" -->